Brief Hands-On Report--Apple Released Java 1.3.1 and 1.4.2 Release 2

The Java update is available via Software Update and as a standalone updater from this Apple Web page. According to the Read Me file,

Java 1.3.1 and 1.4.2 Release 2 delivers improved reliability and compatibility for Java on Mac OS X v10.4. This release includes Java 2 Platform Standard Edition versions 1.3.1_16 and 1.4.2_09.

Here are the three major issues addressed by the update:

CVE-ID: CAN-2005-2527
Available for: Java 1.4.2
Impact: A file race condition can lead to file corruption or the
creation of arbitrary files
Description: This is specific to the implementation of Java on Mac OS
X. Under certain conditions, Java may insecurely handle a temporary
directory. Subsequent file operations inside that directory could be
exposed to file race conditions. This update addresses the problem by
adding validation when operating in the temporary directory.

CVE-ID: CAN-2005-2528
Available for: Java 1.3.1, Java 1.4.2
Impact: Insecure temporary file handling can lead to file corruption
or the creation of arbitrary files
Description: This is specific to the implementation of Java on Mac OS
X. The privileged helper used to update Java shared archives
insecurely creates temporary files, which can lead to a file race
condition. This update addresses the issue by avoiding file
operations in user-accessible locations. This issue does not affect
systems prior to Mac OS X v10.4. Credit to
kf_lists[at]digitalmunition[dot]com for reporting this issue.

CVE-ID: CAN-2005-2529
Available for: Java 1.4.2
Impact: Malicious system users can gain elevated privileges
Description: This is specific to the implementation of Java on Mac OS
X. The utility used to update Java shared archives is susceptible to
a privilege escalation vulnerability from local system users. This
update addresses the issue by performing additional clean-up before
launching the utility on behalf of unprivileged users. This issue
does not affect systems prior to Mac OS X v10.4. Credit to Dino Dai
Zovi for reporting this issue.

Further information is available in the 1.4.2_09 section of Sun's release notes and in the 1.3.1_16 section of Sun's release notes.

We downloaded and installed Java 1.3.1 and 1.4.2 Release 2 on a variety of Macs running Mac OS X 10.4.2: Power Mac G5 and G4 Cube, Mac mini, iMac G5 and PowerBoook G4. No problems were encountered either during installation or during limited use. We tried some Web pages that used to have javascript problems with Safari and found that none returned. One does need to restart one's Mac, even though it is not required, or running the Software Update pane again will try to install the update again. [Bill Fox and Dana Baggett]